keep/src/cli/commands/recipient.ts

import { adminFetch, expectOk } from '../signedFetch.js';

export async function recipientAdd(label: string, publicKey: string): Promise<void> {
  const data = await expectOk(await adminFetch('POST', '/api/admin/recipients', { label, publicKey }));
  console.log(`recipient created: ${data.recipientId}`);
  console.log(`Give this id back to whoever owns this identity — they set it with 'keep identity set-id ${data.recipientId}'.`);
}

export async function recipientList(): Promise<void> {
  const data = await expectOk(await adminFetch('GET', '/api/admin/recipients'));
  if (!data.length) { console.log('no recipients yet.'); return; }
  for (const r of data) {
    console.log(`${r.recipientId}  ${r.label}  ${r.publicKey.slice(0, 16)}…`);
  }
}

export async function recipientRemove(recipientId: string): Promise<void> {
  await expectOk(await adminFetch('DELETE', `/api/admin/recipients/${encodeURIComponent(recipientId)}`));
  console.log(`recipient removed: ${recipientId} (and all their vault grants)`);
}

export async function adminOverview(): Promise<void> {
  const data = await expectOk(await adminFetch('GET', '/api/admin/overview'));

  console.log('recipients:');
  if (!data.recipients.length) console.log('  none yet.');
  for (const r of data.recipients) {
    console.log(`  ${r.recipientId}  ${r.label}`);
  }

  console.log('\nvaults:');
  if (!data.vaults.length) console.log('  none yet.');
  for (const v of data.vaults) {
    console.log(`  ${v.vaultKey}`);
    for (const g of v.grants) {
      console.log(`    ${g.canWrite ? 'rw' : 'r-'}  ${g.recipientId}  ${g.label ?? '(unknown recipient)'}`);
    }
  }
}